Healthcare cybersecurity: A comprehensive guide for accredited general practices

Healthcare cybersecurity is now an urgent priority for accredited general practices as the sector faces escalating threats of data breaches and cyberattack. 

In the first half of 2024, healthcare reported the highest number of data breaches of any Australian industry, accounting for nearly one in five (19%) of all notifications to the Office of the Australian Information Commissioner (OAIC). 

In this guide, we outline the biggest cybersecurity threats to accredited general practices and share healthcare cybersecurity tips to help protect your practice.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), anyone who collects, deals with or discloses personal information must comply with data privacy obligations. 

Organisations must meet the 13 APPs, along with any additional obligations under state or territory privacy laws. 

Breaches of the APPs can result in substantial penalties – up to $2.5 million for individuals and potentially over $50 million for companies. 

You can read Avant’s easy-to-read guide for an overview of your obligations under the APPs. 

In the first half of 2024, 67% of all data breaches reported to the OAIC were caused by cybersecurity incidents. The top threats included: 

1. Phishing (31% of all cybersecurity incidents): Cybercriminals trick individuals into revealing sensitive information, such as passwords or credit card numbers, via fraudulent emails or messages. 
    
2. Ransomware (24%): Malicious software locks or encrypts data, and attackers demand payment to restore access. 
    
3. Compromised or stolen credentials (24%): Hackers gain unauthorised access by stealing login credentials, often due to weak passwords or unsecure storage. 

Ex-healthcare employee exposes sensitive data of 20,000 individuals 

Healthcare organisations and accredited general practices are increasingly targeted by cybercriminals due to the high value of personal and health information they store. 

A significant example highlighted in the OAIC’s 2024 report involved a healthcare provider where a former employee accessed and disclosed sensitive data of over 20,000 individuals over two years.  

The former employee exploited their unauthorised access to share information with an external party for financial gain, using both work-issued devices and personal accounts. 

In response, the provider implemented new monitoring systems to flag high-volume record access, large data copying and file uploads to external sites. 

In November 2024, the Cyber Security Act 2024 (Cth) became law. The law will take effect upon receiving royal assent. 

One of the key obligations it will introduce is mandatory reporting of cyber extortion incidents for organisations that have over $3 million in annual revenue or are responsible for critical infrastructure assets.  

If they make a ransomware payment, these organisations must report it to the Australian Signals Directorate within 72 hours. 

The legislation will also require manufacturers and suppliers to adhere to minimum cyber security standards for smart devices, along with other measures.  

Healthcare cybersecurity requires all practice team members to be vigilant of potential threats. Here are some essential tips to help safeguard against common threats: 

Preventing phishing attacks 

• Train staff to identify phishing emails, such as those with suspicious links or urgent requests for sensitive information. 
• Avoid clicking on links or downloading attachments from unknown sources. 
• Use email filtering tools to block suspicious messages. 

Protecting against ransomware 

• Regularly back up critical data, test backups and ensure they’re stored securely offline. 
• Keep all software and security systems updated to patch vulnerabilities. 
• If affected by ransomware, do not pay the ransom. Contact the Australian Cyber Security Centre’s 24/7 hotline at 1300 CYBER1 (1300 292 371) for support. 

Securing against compromised or stolen credentials 

• Implement strong passwords and update them regularly. 
• Enable multi-factor authentication (MFA) to add an extra layer of security. 
• Restrict system access to authorised personnel only. 

Even with the right protections in place cyberattacks remain a possibility. That’s why some practices are turning to cyber insurance for added protection. 

You can learn about Avant’s cyber insurance, which is offered as complimentary cover to eligible practices as part of our practice medical indemnity policy. 

Or for more practical cybersecurity tips you can read our checklist for improving healthcare cybersecurity and our guide to responding to a cyber incident. 

Human error accounted for 30% of data breaches reported to the OAIC in the first half of 2024. The most common errors included: 

1. Sending personal information to the wrong recipient (38% all human error incidents).
2. Unintentionally releasing data publicly (24%).
3. Failing to use BCC in emails and thereby exposing email addresses (10%).

The importance of reducing human error is highlighted by these real-world examples reported to the OAIC: 

1. Sensitive information sent to the wrong recipient 

In 2022, a Victorian general practice was ordered to pay $16,400 in fines after an email containing highly sensitive patient information, including HIV status, was mistakenly sent to an incorrect recipient. 

Following this costly error, the practice implemented stricter email verification processes and mandatory staff training on secure communication practices. 

2. Unsecured cloud storage breach 

In 2024, a healthcare provider inadvertently exposed sensitive health referral documents when an employee changed cloud storage security settings during an upload. The breach was discovered when the documents became publicly accessible. 

In response, the organisation restricted access permissions, implemented automated alerts for policy violations and introduced mandatory cybersecurity training for all staff. 

• Develop and enforce policies on secure email practices. 
• Obtain and document patient consent before using email to communicate sensitive information. 
• Limit access to systems to select staff members. 
• Use encryption or password protection for email communications and provide passwords via secure channels. 
• Verify email addresses before sending and regularly confirm patient contact details in your system. 

For more practical guidance, you can read our guide on how to help prevent data breaches. 

Using a digital solution like PracticeHub can help simplify cybersecurity and data privacy compliance for your accredited general practice. Here’s how: 

1. Pre-written policies and procedures 

PracticeHub offers expertly written, customisable templates to help support robust cybersecurity measures, including: 

• A privacy and confidentiality policy covering how information is shared and accessed.
• A system security policy detailing confidentiality measures, firewalls, remote access and data backups.
• A My Health Record policy outlining secure usage and access protocols.
• An email use policy addressing patient consent, email verification, password protection and encryption. 

2. Centralised, sharable registers for enhanced visibility 

PracticeHub’s equipment and contract registers help you track IT assets and manage agreements with software providers, antivirus services and IT support. 

You can also create your own registers with PracticeHub’s Custom Registers module. For example: 

• A Clinical Software Access Register to monitor who has access to specific platforms and when it was granted.
• An IT Device Loan Register to track the location and use of your devices. 

You can easily upload documents, set reminders for key dates and share registers with select team members. 

3. Privacy and confidentiality online training 

As one of eight e-learning courses in the platform, PracticeHub offers a course on privacy and confidentiality that covers privacy legislation, APP requirements and IT security. 

It’s easy to assign this training to your team and monitor their progress with instant alerts.  

Meanwhile, a final quiz assists in identifying knowledge gaps so you can set up further training if necessary. 

While PracticeHub can help improve healthcare cybersecurity, its benefits extend far beyond.   

Specifically designed for accredited general practices, it helps reduce admin by centralising all your tasks, documents, registers, incident management and more in one intuitive platform.  

Book a 30-minute demo today to see how PracticeHub can help transform your practice’s efficiency and support your team.